Buggy code:
@ Controller public class LoginController extends AbstractController { private static final int MAX_USERNAME_LENGTH = 15 ; private static final int MAX_GUESTHASH_LENGTH = 10 ; @ Value ( "${api.path:}" ) private String apiPath ; @ Value ( "${customization.path}" ) private String customizationPath ; @ Value ( "${security.guest.enabled}" ) private String guestEnabled ; @ Value ( "${security.guest.lecturer.enabled}" ) private String guestLecturerEnabled ; @ Value ( "${security.guest.order}" ) private int guestOrder ; @ Value ( "${security.custom-login.enabled}" ) private String customLoginEnabled ; @ Value ( "${security.custom-login.title:University}" ) private String customLoginTitle ; @ Value ( "${security.custom-login.login-dialog-path}" ) private String customLoginDialog ; @ Value ( "${security.custom-login.image:}" ) private String customLoginImage ; @ Value ( "${security.custom-login.order}" ) private int customLoginOrder ; @ Value ( "${security.user-db.enabled}" ) private String dbAuthEnabled ; @ Value ( "${security.user-db.title:ARSnova}" ) private String dbAuthTitle ; @ Value ( "${security.user-db.login-dialog-path}" ) private String dbAuthDialog ; @ Value ( "${security.user-db.image:}" ) private String dbAuthImage ; @ Value ( "${security.user-db.order}" ) private int dbAuthOrder ; @ Value ( "${security.ldap.enabled}" ) private String ldapEnabled ; @ Value ( "${security.ldap.title:LDAP}" ) private String ldapTitle ; @ Value ( "${security.ldap.login-dialog-path}" ) private String ldapDialog ; @ Value ( "${security.ldap.image:}" ) private String ldapImage ; @ Value ( "${security.ldap.order}" ) private int ldapOrder ; @ Value ( "${security.cas.enabled}" ) private String casEnabled ; @ Value ( "${security.cas.title:CAS}" ) private String casTitle ; @ Value ( "${security.cas.image:}" ) private String casImage ; @ Value ( "${security.cas.order}" ) private int casOrder ; @ Value ( "${security.facebook.enabled}" ) private String facebookEnabled ; @ Value ( "${security.facebook.order}" ) private int facebookOrder ; @ Value ( "${security.google.enabled}" ) private String googleEnabled ; @ Value ( "${security.google.order}" ) private int googleOrder ; @ Value ( "${security.twitter.enabled}" ) private String twitterEnabled ; @ Value ( "${security.twitter.order}" ) private int twitterOrder ; @ Autowired ( required = false ) private DaoAuthenticationProvider daoProvider ; @ Autowired ( required = false ) private TwitterProvider twitterProvider ; @ Autowired ( required = false ) private Google2Provider googleProvider ; @ Autowired ( required = false ) private FacebookProvider facebookProvider ; @ Autowired ( required = false ) private LdapAuthenticationProvider ldapAuthenticationProvider ; @ Autowired ( required = false ) private CasAuthenticationEntryPoint casEntryPoint ; @ Autowired private IUserService userService ; @ Autowired private UserSessionService userSessionService ; public static final Logger LOGGER = LoggerFactory . getLogger ( LoginController . class ) ; @ RequestMapping ( value = { "//auth//login" , "//doLogin" } , method = { RequestMethod . POST , RequestMethod . GET } ) public final void doLogin ( @ RequestParam ( "type" ) final String type , @ RequestParam ( value = "user" , required = false ) String username , @ RequestParam ( required = false ) final String password , @ RequestParam ( value = "role" , required = false ) final UserSessionService . Role role , final HttpServletRequest request , final HttpServletResponse response ) throws IOException { } @ RequestMapping ( value = { "//auth//dialog" } , method = RequestMethod . GET ) @ ResponseBody public final View dialog ( @ RequestParam ( "type" ) final String type , @ RequestParam ( value = "successurl" , defaultValue = "//" ) String successUrl , @ RequestParam ( value = "failureurl" , defaultValue = "//" ) String failureUrl , final HttpServletRequest request , final HttpServletResponse response ) throws IOException , ServletException { } @ RequestMapping ( value = { "//auth//" , "//whoami" } , method = RequestMethod . GET ) @ ResponseBody public final User whoami ( ) { } @ RequestMapping ( value = { "//auth//logout" , "//logout" } , method = { RequestMethod . POST , RequestMethod . GET } ) public final View doLogout ( final HttpServletRequest request ) { final Authentication auth = SecurityContextHolder . getContext ( ) . getAuthentication ( ) ; userService . removeUserFromMaps ( userService . getCurrentUser ( ) ) ; request . getSession ( ) . invalidate ( ) ; SecurityContextHolder . clearContext ( ) ; if ( auth instanceof CasAuthenticationToken ) { if ( "" . equals ( apiPath ) ) { apiPath = request . getContextPath ( ) ; } <START_BUG> return new RedirectView ( ( ( apiPath ) + "//j_spring_cas_security_logout" ) , true ) ; <END_BUG> } return new RedirectView ( ( ( request . getHeader ( "referer" ) ) != null ? request . getHeader ( "referer" ) : "//" ) ) ; } @ RequestMapping ( value = { "//auth//services" } , method = RequestMethod . GET ) @ ResponseBody public final List < ServiceDescription > getServices ( final HttpServletRequest request ) { } private Collection < GrantedAuthority > getAuthorities ( ) { } @ RequestMapping ( value = { "//test//me" } , method = RequestMethod . GET ) @ ResponseBody public final User me ( ) { } @ RequestMapping ( value = { "//test//mysession" } , method = RequestMethod . GET ) @ ResponseBody public final Session mysession ( ) { } @ RequestMapping ( value = { "//test//myrole" } , method = RequestMethod . GET ) @ ResponseBody public final Role myrole ( ) { } }

Fix:
return new RedirectView ( ( ( apiPath ) + "//j_spring_cas_security_logout" ) ) ;